Upgrading aiosmtplib 4 to 5
Breaking4.0.2 → 5.1.3Security3Platform1New1Fixed27Other3
SecurityRejects addresses with whitespace or angle brackets outside a quoted local part in mail, rcpt, vrfy, expn and sendmail to prevent ESMTP parameter smuggling.CVE-2026-53533 ↗
BreakingUpgrade verdict
A platform requirement change and 3 security fixes.
In plain terms
- This version no longer works on Python 3.9, so users on that version must upgrade Python before upgrading the package.
- Blocks email addresses crafted to sneak extra commands into the mail server conversation.
- Before switching to an encrypted connection, the library now throws away any leftover data from the server, so an attacker cannot sneak in fake responses that would be treated as encrypted.
- Input containing hidden control characters is now refused before it can be sent to the mail server, blocking a way to sneak extra commands into an email session.
Must act 4 items need code or config changes
Python requirement changed in 5.0.0: >=3.9 → >=3.10.
What you must change
Security3
Rejects addresses with whitespace or angle brackets outside a quoted local part in mail, rcpt, vrfy, expn and sendmail to prevent ESMTP parameter smuggling.
mailrcptvrfyexpnsendmailDiscards buffered server data before the STARTTLS handshake to prevent a response-injection attack.
STARTTLSMedium · CVSS 5.9Rejects control characters (C0 range 0x00-0x1F and DEL 0x7F, including CR, LF, NUL) in SMTP command arguments to prevent command injection.
mail()rcpt()vrfy()expn()sendmail()ValueErrorPlatform1
Drops support for Python 3.9.